Security "Reset" When Prod is Copied to Dev

In short:

• copying applications at the Database level (including all data) will copy any Security Group references by Guid.  That's not a problem so long as you are copying within the same Environment, as all apps share the same Framework Database, where Security is defined.  The problem occurs when copying apps between environments where Security Groups may have been created manually in each environment, and thus will have different internal Guid's between the environments.
• Extract/restoring an app via XML will reference Security Groups by Name (not Guid).  Upon restore, OS will convert the Security Group references to the Guid's for that of the environment the app is being restored to.
• If you manually create the same Security Group in two Environments, they will each assign a different internal Guid.  Internally OS uses the Guid throughout as the Security Group reference.  Same sort of deal occurs with dimension Members which will get a unique MemberId, among many other objects in OS.  But Security Groups can be problematic, as they are assigned in the Framework database which is shared across all the apps within an Environment.

If you think you are going to need to be copying apps between environments, you really need to make sure you always use the copy the Security with the Extract Unique IDs option enabled to make sure the users and groups share the same internal Guid's between the two environments.  The members of a security group do not need to match.  But the Guid's (especially of the Security Groups) really do need to match, else you will run into problems when you start copying apps between environments.

Once you see the Security Groups of a restored app are messed up, I have found the following solutions work (there might be other options):

Option 1 - Delete the Security Group having a non-matching Guid on the destination side and then export/import the Security Group with the Extract Unique IDs (Guid's) checked.  Do that for each of the Security Groups where Guid's do not match between environments.  Restart OS the destination side - that is a must, as OS caches a lot of this info in memory.  That usually gets the broken Security Group references back in the restored app.  This option is really only viable if the destination environment does not have any other apps that could also be referencing Security Groups for which you changed the Guid's, otherwise you will break those apps when the internal Guid's change.  Hence, why you really want to keep the Security Group Guid's in-synch between environments from the get go.

Option 2 - After restoring the app Database and seeing there is a problem, then export the entire app (everything but FX Rates) from the source app via XML, then restore that overtop of the messed-up destination app.  Since the XML files reference all Security Groups by Name (not the Internal Guid),  OS will reassign the Guid's to that of the Security Groups it finds.

Option 3 - If you don't care about the Security, there is a Marketplace solution that will perform a search and destroy through an XML extract changing all the Security Group References to Everyone, Administrators, etc.  This would be a slight variation to option 2.